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We suggest a quantum cryptographic scheme using continuous EPR-like correlations of bright 
optical beams. For binary key encoding, the continuous information is discretized in a novel way by 
associating a respective measurement, amplitude or phase, with a bit value "1" or "0". The secure 
key distribution is guaranteed by the quantum correlations. No pre-determined information is sent 
through the quantum channel contributing to the security of the system. 
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Quantum key distribution (QKD) is the most advanced 
technology in the field of quantum information pro- 
cessing. The conventional arrangements use dichotomic 
quantum systems to realize the secure information trans- 
fer (for a review see [0). These discrete systems have the 
advantage to be in principle loss insensitive in terms of 
security. However, the generation process for entangled 
photon pairs needed for QKD based on EPR correlations 
is spontaneous and therefore probabilistic. This limits 
the achievable data transmission rates. 

A new development employs continuous variable sys- 
tems such as intense light fields, to obtain shorter 
key distribution times. The security issues of continu- 
ous variable quantum cryptography have been addressed 
1^,0 and it was proven that the secure key distribution 
can be achieved using continuous EPR-type correlation 
or quantum squeezed states. 

In this Letter we propose a new key distribution 
scheme based on the quantum EPR-like correlations of 
conjugate continuous variables. The main novel feature 
of the protocol Q is an assignment of a bit value to the 
type of measurement. The binary bits are encoded by 
the choice to detect either of two conjugate variables ac- 
complished independently and randomly by both com- 
municating parties. This serves as a discretization of 
continuous information in the measurement process. The 
coincidences in the choices of both parties are revealed by 
testing the EPR-like correlations between the beams and 
contribute to the key. Thus, in contrast to other contin- 
uous variable systems [^-^ , the basis value is not prede- 
termined but develops in measurements at receiver and 
sender stations, resembling the EPR-based Ekert proto- 
col for discrete cryptographic systems. The detection of 
light statistics performed by both communicating parties 
plays a decisive role in the proposed scheme. It comprises 
bit encoding, key sifting, monitoring of the disturbance 
in the quantum channel and active control on timing and 
information flow during the transmission |^ . 

The basic ingredient of the scheme are quantum cor- 
relations between the amplitude Xj = a] + cij and phase 
Yj = i{a}- — dj) quadratures of bright beams j = 1,2. Be- 



cause of the high intensity of the optical fields involved, 
we use the linearization approach throughout the paper: 
Xj ^ (Xj) + dXj, Yj = (Yj) + SYj. The entangled ob- 
servables are then the quantum uncertainties in the re- 
spective field quadratures. We start with the definition 
of the relevant measured quantities and of the conditions 
for appling the two-mode correlations as a quantum re- 
source. It can be done on the basis of the non-separability 
criterion for continuous variables . 

The Peres-Horodecki criterion for continuous variables 
provides a sufficient condition for a Gaussian state to be 
non-separable ||l^.|ll| . It can be written in terms of sum 
or difference squeezing variances of amplitude and 
phase of two beams: 



(1) 

(2) 



where V{A) is the variance (A^) — (A)'^ of an observable 
A. The field modes are denoted by the respective sub- 
scripts, SN labels the shot noise limit for a corresponding 
beam, and g is a variable gain to minimize the variance 
p2| . In the particular case of entirely symmetrical entan- 
gled beams the optimal gain is calculated to be g = 1 . 
The non-separability of the two-mode quantum state re- 
quires then V+^{X) + V^-{Y) < 2 0,|ll[ and the crite- 
rion is necessary and sufficient [pl| . From here on we use 
Eqn. (|l|, |2|) with the signs corresponding to amplitude 
anti-correlations and phase correlations. The two-mode 
non-separable state is said to be squeezed-state entangled 
if the following condition is satisfied for the variances of 
conjugate variables in Eqs. (|l|, ^) ||l^: 



V+{X) < 1, 



VsaiY) < 1. 



(3) 



Note, that in contrast to the non-separability crite- 
rion, the introduced squeezed-state entanglement re- 
quires both variances of conjugate variables to drop be- 
low the respective limit. This requirement is crucial for 
the suggested cryptographic system and ensures both the 
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possibility to build up a binary key string and the secu- 
rity of a transmission. 
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FIG. 1. QKD with bright EPR-entangled beams (see text). 

A key point for the QKD protocol is sum (differ- 
ence) measurement (|l|, ^ testing for the correlation in 
the amplitude and phase quadratures. It is used to de- 
termine a bit value and it ensures an undisturbed trans- 
mission. Suppose Alice and Bob both record the ampli- 
tude quadratures of their respective EPR-beam. In this 
case the detected quantum uncertainties SXi and 6X2 
are anti-correlated jlj]. Bob tests for anti-correlations 
by recording the variance of the sum (Q) of photo cur- 
rents of his and Alice's measurement. Note, however, 
that the time interval used to experimentally determine 
the photo current statistics plays a crucial role for the 
security of the protocol because it may allow for an unde- 
tectable eavesdropping (see below). At this stage we ex- 
plain the protocol in terms of squeezing variances for the 
sake of clarity in the presentation of main ideas. If there 
is a non-local anti-correlation between 6X1 and SX2 , the 
sum photo current will drop below the quantum limit, 
Vgq{X) < 1, to the extent dependent on the quality of 
the EPR source. Analogously, if there is non-local cor- 
relation between 5Yi and SY2 the difference photo cur- 
rent will drop below the quantum limit V^^{Y) < 1 (j^). 
The quality of the source is limited by the finite degree 
of continuous quantum correlations Vsq{X),Vsq(Y) (j^, 
perfect correlation requiring infinite energy resources. 
For the efficiency of transmission, noise and losses in the 
quantum channel play a significant role. The net quality 
of both the source and the channel has impact on the 
distance, on which the quantum correlations are still re- 
liably observable, on the sensitivity to the disturbance by 
an eavesdropper and on possible achievable bit rates. 

The obtained constraint Vsq{X) ^ 1 and Vsq{Y) <C 1 
serve Bob as a criterion for the generation of the sifted 
key and as a test for eavesdropping. A measured normal- 
ized noise power of Vsq{X) ^ 1 at Bob's station delivers 
a bit value "1" and VsqiY) < 1 a bit value "0". The ob- 
servation of Vsq{X), Vsq(Y) > 1 means that both parties 



have measured different quadratures. These events are 
discarded. However, Alice and Bob should keep control- 
ling that the overall rate of the event " no correlation" is 
statistically close to 50% as is inherent to the protocol 
{X or Y quadrature). Vsq{X),Vsq{Y) < 1 to an extent 
less then expected or no correlations in more than 50% 
measurements reveals an unexpected disturbance in the 
line. Note, that there is no need to communicate the 
obtained constraints Vgq ^ 1 to Alice. 

The quantum key distribution protocol for squeezed- 
state entangled bright beams based on the measurement 
of the EPR-like correlations works as follows. The EPR- 
source is at Alice's station (Fig. |]). Alice generates and 
distributes the entangled beams keeping beam 1 at her 
station and sending beam 2 to Bob. The relevant mea- 
sured quantities are the quadrature quantum uncertain- 
ties which a priori carry no information. To establish the 
right timing of their recordings Alice and Bob have to 
synchronize their clocks and agree upon a set of time in- 
tervals Atk in which they subdivide their measurements. 
Alice and Bob proceed with a series of measurements. 

The expected quality of quantum correlations 
Vsq{X),Vsq{Y) < 1 is determined experimentally as de- 
scribed above. Alice and Bob start a key transmission by 
performing randomly and independently measurements 
of either amplitude quadrature AQ or phase quadrature 
PQ each. Hereby they keep recording: 1) their photo cur- 
rents {SXj, 6Yj), 2) the respective time slots (i^), and 3) 
the type of measurement performed (AQ or PQ). 

Bob and Alice use two classical communication chan- 
nels to evaluate the transmission results. Alice perma- 
nently keeps sending the results of her measurements, 
the photo current containing SX2 or SY2 in the time 
slots tk, to Bob via a classical channel I. Bob performs 
the selection of "good" bits and the security test. To 
generate the sifted key, he checks correlations between 
the results of his measurements and the results received 
from Alice by recording the variance V^{X) (|l|) of the 
sum of the relevant photo currents for his choice of AQ 
or the difference variance Vgg{Y) (||) for PQ. 

After evaluating his correlation measurements (Fig. ^), 
Bob publicly communicates to Alice via the classical 
channel II the time points ti,i3, ...,ifc when he detected 
correlations (||) . The choice of the AQ / PQ measurement 
is not disclosed. At this stage Alice and Bob can generate 
the common secret key. They pick up the measurement 
type (AQ/PQ) from their recordings at the time points 
ti, ta, ife and build the secret key string by association: 
AQ = bit value " 1" and PQ bit value " 0" . They discard 
the rest of the data. The presence of Eve will be revealed 
by distortion of the correlations or by events "no corre- 
lations" occurring statistically more frequent than 50%. 
This protocol is summarized in Table 1. 

The security of transmission against eavesdropping is 
guaranteed by the sensitivity of the existing correlations 
to losses and by the impossibility to measure both con- 
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jugate variables simultaneously. The complete security 
analysis for the case of continuous variables is non-trivial 
and lies beyond the scope of the present Letter. It will be 
considered elsewhere in terms of mutual information and 
disturbance of transmission p5| ] and using noise charac- 
teristics like signal-to- noise ratio Here we restrict 
ourselves to the optical tap attack of an eavesdropper Eve 
and for an idealized case of lossless quantum channel to 
illustrate the main security mechanisms. The tapping 
beam splitter has a transmissivity 77. 

Table 1: Generation of the common secret key string. 
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An eavesdropper Eve will attempt to figure out which 
quadrature was measured by Alice by tapping the quan- 
tum channel and by trying to relate these measure- 
ments to the photo currents travelling from Alice to Bob 
through the classical channel. If Eve has decided to de- 
tect the amplitude quadrature by tapping, she has at her 
disposal the minus and plus channels: 



KJ(Xe;Za) 



ViSXE T .9E SZa) 



V{X 



E,SN 



Za. 



Za = Xa,Ya. (4) 



SN) 



Subscripts E, A denote the quantum uncertainties, mea- 
sured respectively by Eve and by Alice, upper (lower) 
sign refers to the minus (plus) channel, and is a vari- 
able gain used by Eve. To construct the secret key, Eve 
must be able to distinguish between two possible events: 
SZa = SXa or SZa = SYa- An effective strategy for Eve 
is to check the difference between her plus and minus 
channels A = V^-{Xe; Za) - V^+{Xe; Za)- No difference 
between recordings in these two channels reveals to Eve 
that she and Alice have measured different quadratures. 
If Eve records a significant difference A, she knows that 
she and Alice have measured the same quadrature: 



A^V,-iXE;XA)-V+iXE;XA) 



(5) 



VIT^ [v+{x) + v-^{x)] 



Here Vg^{X) is the normalized sum photo current noise 
for the amplitude quadratures measured by Alice and 
Bob during the undisturbed transmission. It is given by 
the squeezing variance [Eq. (m] with the optimal gain 
.9 = .9sq = 1- Vs'q{X) [Eq. (|lp] is the difference photo 
current noise which is recorded in Bob's minus channel 
for an amplitude measurement. If the beams of Alice and 
Bob arc anti-correlated in the amplitude quadrature, the 



variance V^{X) is well below unity. Due to the quan- 
tum penalty the complimentary variance V~{X) exhibits 
then substantial excess noise. Equation (h) thus shows 
that though Eve can split off a small fraction of the signal 
and process arbitrarily her measurement results which 
are classical photo currents, she will be limited by in- 
herent noise present in the signal. Eve can amplify her 
signal using the electronic gain but it will not improve 
the signal-to-noise ratio of the detected light field. 

We discuss now which means Alice and Bob have at 
their disposal to reveal the malicious disturbance caused 
by Eve in the quantum channel. First, we review an- 
other criterion for quantum EPR-like correlations intro- 
duced by Reid and Drummond fl^ . For the discussions 
about this EPR condition and about the nonseparabil- 
ity criterion see p7| , [l3|| and references therein. The EPR 
criterion refers to the demonstration of the EPR paradox 
for continuous variables and specifies the ability to infer 
"at a distance" either of the two non-commuting signal 
observables with a precision below the vacuum noise level 
of the signal beam . The relevant inference errors 
at the optimal gain are the conditional variances: 



Kond(^l|^2) = 



K^onAyi\y2) = 



V{dXi ±g 6X2) 

V(^i,sn) 
V{SY,TgSY2) 



(6) 



(7) 



ViYi,sN) 

The demonstration of the EPR paradox for continuous 
variables |l^,|l^,Q corresponds to: 



KlnAXl\X2)Ko^^iY,\Y2)<l. 



(8) 



An interesting tool to control the quantum channel is the 
variable gain g in definition of these conditional variances 
Kid(^il^2) [Eqn. (0,1)]. 

Let us consider first the undisturbed transmission with 
an example of the amplitude measurement performed 
by Bob. Even for symmetrical squeezed-state entangled 
beams the optimal gain to minimize the conditional vari- 
ance Kond(^il^2) [Eq. (^)] differs from unity. It can be 
expressed as: 



^cond 



V-{X)-V+{X) 



Vs^iX) + Vst{X) ' 

With ]/+(X) 0, the noise variance in the minus chan- 
nel V^~{X) 00 and the optimal gain for V^^^{Xi\X2) 
is also approaching unity gcond ^ 1 , like the optimal gain 
for the squeezing variances [Eqn. (|l|, |^)]. 

Consider now, how the invasion of an eavesdropper 
is reflected in the measurements at Bob's station. The 
sum photo current measured by Bob, Vg^{X; 77), becomes 
more noisy in the presence of Eve: 

Vv)' 



V+{X;^)=^— 



(1 - Vv)' 



VsliX) 

v-Ax) + 



(10) 
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containing V^~{X) 1. Analogously, the signal in Bob's 
minus channel, i. e. the variance Vg~{X]ri), will be also 
changed, both plus and minus channel approaching the 
same limit. Note that Eve should be cautious enough to 
keep the classical amplitude of Bob's signal unchanged. 
Bob uses, therefore, the unchanged value of the shot noise 
level to which the measured noise variances are normal- 
ized to obtain Vsq corresponding to gsq = 1. 

The modified noise variances in the plus and minus 
channel Vg^{X; if) will be reflected in the optimal gain to 
minimize the conditional variance g^o 

Vs-q{X)-V+{X) 



(|): 



t/cond 



(11) 



Vs^{X) + Vs+iX) 

This gain also minimizes the observed unnormalized noise 
variance V{6Xi ± g 6X2). If Bob monitors (7cond(?7) (0) 
in his measurements, he can easily infer 77 7^ 1 in the 
quantum channel. 

An important issue is the finite time for the confident 
experimental determination of the squeezing variance. 
To gain some partial information, when decoding Vsq Eve 
might go for less time than both legitimate communicat- 
ing parties, accepting less confidence in determining the 
variance. She will tap the signal for a fraction of Bob's 
measurement time and hence will introduce less distur- 
bance as expected for a given beam splitting ratio. The 
losses in the channel reduce the correlations and enhance 
the time needed for the determination of the variance 
with sufficient precision. If Eve is tapping close to Alice, 
where the impact of losses is still negligible, she can addi- 
tionally profit from less time needed for her measurement 
compared to that of Bob with a given confidence level. 
The optimum strategy for Alice and Bob seems to be to 
operate with as short a measurement time as possible, 
ultimately with single measurements. The above statis- 
tical analysis in terms of variances should therefore be 
extended to cope with single shot measurements. This, 
however, is beyond the scope of discussion presented here 
and will be considered in detail elsewhere. 

To summarize, the scheme presented here possesses 
several novel features and shows the strong sides of con- 
tinuous variable cryptography. The effect of losses on the 
maximum possible transmission distance will have to be 
studied further. The bit value is encoded by the type of 
measurement, i. e. by the choice of measured observable 
amplitude or phase. The information on the key is thus 
emerging only " a posteriori" , at sender and receiver sta- 
tions. One of the advantages of the presented scheme is 
the high value of the achievable effective bit rates. For 
example, for the pulsed EPR source the principle theo- 
retical limit is given by half of the repetition rate i?iop, 
the factor ^ being inherent to the protocol and realistic 
values of -Riop reaching up to 100 GHz. The implemen- 
tation of the scheme with bright EPR-entangled beams 
is experimentally simple and robust and well suited 
for both fiber-integrated or free-space transmission. 
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